OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Console and tools
A single Go binary: the console API, the React console files, and a proxy to the Keystone catalog.
OpenKeel implementation in Go of OpenStack skyline-apiserver, the back end of the Skyline dashboard, generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. skyline-console runs unchanged against it: same routes under /api/openstack/skyline/api/v1, same session cookie and JWT, same profile, list and error bodies. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist, including the session key handling, is in docs/SECURITY.md.
One image and one process do what the Python container did with nginx and gunicorn:
GET /extension/server_metrics: CPU, memory and disk usage of the project's instances for the console's Metrics page);/, with the single-page fallback; they are built into the image (/usr/share/skyline-console) from the stable/2026.2 sources;/api/openstack/<region>/<service>/ to the OpenStack APIs of the Keystone catalog, re-read every minute (no restart when the catalog changes).Peers: Keystone (openkeel-keystone), Nova, Cinder, Glance, Neutron through the catalog, Prometheus, and a small MariaDB Galera database (revoked_token, settings).
Name: openkeel-skyline, not openkeel-skyline-apiserver, because the project covers the Skyline server side as a whole (the API and the nginx of the Python container) while skyline-console stays upstream. The binary keeps the upstream name skyline-apiserver; the reverse-specification is reverse-spec-skyline-apiserver/.
github.com/openkeel/openkeel-skylineskyline-apiserver (API, console and proxy on port 9998, health and readiness on 9090)Excerpt from openkeel-skyline/README.md (in English).
30 operations of the original REST API (routes and body actions), and their state in OpenKeel.
The target is the unchanged skyline-console: recorded scenarios are replayed with their outbound calls, policies and session tokens are compared with Python, and the built console is replayed against Go.
Recorded scenarios give the same status, body and cookies, and the same non-Keystone calls to OpenStack in the same order.
make e2e against internal/fakeos, on go-mysql-server and MariaDB 11.4.
Latest result 44 / 45 identical on both engines, 1 deliberate difference; 118 outbound calls instead of 222.
Source: openkeel-skyline/docs/CONFORMANCE.md
All embedded policy rules decide as oslo.policy, and the session token is byte-identical to python-jose's.
internal/skypolicy/testdata/policy-vectors.json and internal/session/session_test.go.
Latest result 1 862 rules × 7 personas identical; byte-identical JWT for the same payload and key.
Source: openkeel-skyline/docs/CONFORMANCE.md
Requests recorded with the built console get the recorded statuses, and proxied calls reach their endpoints with the expected headers.
test/e2e/console_test.go with E2E_CONSOLE_DIR on the console files of the image.
Latest result 35 / 35.
Source: openkeel-skyline/docs/CONFORMANCE.md
Login, profile, policies, project switch, contrib endpoints, wrong-password text, logout and the Keystone proxy work against openkeel-keystone.
Live run against a MariaDB-seeded Go Keystone, identity endpoint only.
Latest result System admin policies: 1 817 / 1 860 allowed, as Python against its fake.
Source: openkeel-skyline/docs/CONFORMANCE.md
Concurrent first writes of one setting and concurrent logouts stay consistent across three nodes.
make galera-test on galera1 to galera3.
Latest result Pass, 3 runs out of 3: one row, same value on every node, 0 × 5xx.
Source: openkeel-skyline/docs/CONFORMANCE.md
The console's own Cypress suite against the Go services.
Needs the Go services in a kind cluster (Python Skyline in kind: 31 / 34).
Latest result Not run.
Source: openkeel-skyline/docs/CONFORMANCE.md
Skyline becomes one Go binary serving the console, its API and the proxy, without the generated nginx, the CORS option or the FastAPI documentation routes.
The Go server serves the console build and proxies the OpenStack APIs with the generator's path rules.
Catalog changes are read every 60 s instead of needing a restart, and the start no longer fails while Keystone is down.
Source: openkeel-skyline/docs/CONFORMANCE.md
The console is same-origin, and the option prevents start-up on Starlette 1.x anyway.
None for the console, which is served from the same origin as its API.
Source: openkeel-skyline/docs/CONFORMANCE.md
/docs, /redoc and openapi.json are not served, and the policy-manager, swagger and sample-config generators are offline tools of the Python package.
The OpenAPI document lives in the reverse-spec and policy rules are embedded; the console does not use these routes.
Source: openkeel-skyline/docs/CONFORMANCE.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Skyline | Ingress / Gateway API | REST API | all APIs |
| Skyline | Keystone | REST API | login, catalog, system session |
| Skyline | MariaDB Galera | SQL (MariaDB Galera) | settings, revoked tokens |
| Skyline | Nova API | REST API | aggregated lists |
| Skyline | Cinder API | REST API | aggregated lists |
| Skyline | Neutron server | REST API | extensions, ports, FWaaS, VPN, load balancers |
| Skyline | Glance | REST API | images |
| Skyline | Ceph RGW | REST API | containers, objects (Swift API, proxied) |
Branch stable-2026.2 · 8 files
Read the reverse-specBranch stable-2026.2 · 8 files
Read the reverse-spec